CVE-2026-38991: Cockpit CMS RCE Vulnerability

CVE-2026-38991 Overview

CVE-2026-38991 is a file extension bypass vulnerability in Cockpit CMS version 2.13.5 and earlier that allows authenticated attackers to achieve remote code execution. The vulnerability exists within the Bucket component's _isFileTypeAllowed function, where a specially crafted filename can bypass the extension filter mechanism. This allows an attacker with valid credentials to rename arbitrary files with the .php file extension, enabling arbitrary code execution on the underlying server.

Critical Impact

Authenticated attackers can bypass file type restrictions to upload and execute arbitrary PHP code, potentially leading to full server compromise, data exfiltration, and lateral movement within the network.

Affected Products

• Cockpit CMS version 2.13.5 and earlier
• All installations utilizing the Bucket component for file management
• Systems running PHP with Cockpit CMS in web-accessible directories

Discovery Timeline

• April 29, 2026 - CVE-2026-38991 published to NVD
• April 29, 2026 - Last updated in NVD database

Technical Details for CVE-2026-38991

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw resides in the _isFileTypeAllowed function within the Bucket component of Cockpit CMS. The function is responsible for validating file extensions during upload and rename operations, but it fails to properly sanitize or validate specially crafted filenames.

When processing file rename requests, the extension validation logic can be bypassed through filename manipulation techniques. This allows an authenticated user to circumvent the intended security controls that prevent executable file types from being stored on the server. Once a file is renamed with a .php extension, the web server will interpret and execute it as PHP code when accessed directly.

The vulnerability requires authentication, meaning attackers must first obtain valid credentials to the Cockpit CMS administrative interface. However, once authenticated, even low-privilege users may be able to exploit this flaw depending on the configured permissions for the Bucket component.

Root Cause

The root cause is improper input validation in the _isFileTypeAllowed function. The extension filter implementation does not account for edge cases in filename parsing, allowing attackers to craft filenames that pass the validation check while still resulting in executable .php files on the filesystem. This is a classic file upload vulnerability pattern where server-side validation is insufficient to prevent dangerous file types from being stored and executed.

Attack Vector

The attack is network-based and requires low privileges (authenticated user access). The attacker workflow typically involves:

1. Authenticating to the Cockpit CMS administrative interface with valid credentials
2. Uploading a file with allowed extension containing malicious PHP code
3. Using the Bucket component's rename functionality with a specially crafted filename to bypass the extension filter
4. Renaming the uploaded file to have a .php extension
5. Accessing the renamed file directly via the web server to execute arbitrary PHP code

The vulnerability does not require user interaction beyond the initial authentication step, making it straightforward to exploit once access is obtained. Successful exploitation grants the attacker the ability to execute arbitrary commands with the privileges of the web server process.

Detection Methods for CVE-2026-38991

Indicators of Compromise

• Unexpected .php files appearing in Cockpit CMS upload directories or Bucket storage locations
• Web server access logs showing requests to newly created PHP files in upload directories
• File system audit logs indicating file rename operations changing extensions to .php
• Unusual process spawning from the web server process (e.g., www-data or apache)
• Network connections originating from the web server to external hosts

Detection Strategies

• Monitor file system events in Cockpit CMS upload directories for file rename operations that result in .php extensions
• Implement web application firewall (WAF) rules to detect and block suspicious file rename API requests
• Review Cockpit CMS application logs for Bucket component file operations performed by authenticated users
• Deploy file integrity monitoring on web server directories to detect unauthorized creation of executable files

Monitoring Recommendations

• Enable detailed audit logging for the Cockpit CMS Bucket component
• Configure alerts for any file extension changes to executable types (.php, .phtml, .php5, etc.)
• Monitor authentication attempts and track user activity patterns for anomalous file operations
• Implement centralized log collection for correlation of file system and web server events

How to Mitigate CVE-2026-38991

Immediate Actions Required

• Upgrade Cockpit CMS to version 2.14.0 or later immediately
• Review all files in Bucket storage directories for suspicious .php files that may indicate prior exploitation
• Audit user accounts with access to the Bucket component and revoke unnecessary permissions
• Implement additional web server configuration to prevent PHP execution in upload directories

Patch Information

The vulnerability has been addressed in Cockpit CMS version 2.14.0. Organizations should upgrade to this version or later to remediate the vulnerability. For detailed release information, refer to the GitHub Cockpit Release Notes. Additional technical analysis is available from Felsec Multi-Vulns Analysis.

Workarounds

• Configure web server to disable PHP execution in upload directories using .htaccess or server configuration
• Implement additional file type validation at the web server level independent of Cockpit CMS
• Restrict Bucket component access to only trusted administrative users
• Consider placing Cockpit CMS behind a VPN or IP-restricted access control

# Apache configuration to prevent PHP execution in uploads directory
# Add to .htaccess or server configuration
<Directory "/path/to/cockpit/storage/uploads">
    php_admin_flag engine off
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>